Hi Jinxuan,
Please find answer below to your queries,
1) Normalization function applied over the data set is already mentioned in previous post i.e.
normalized = (featurei − μi) / σi
here, "μ" is Mean and "σ" is Standard Deviation
2) Column numbers 38 - 43 are binary features where:
if protocol_type_icmp has value 1 then protocol_type is “icmp”,
if protocol_type_tcp has value 1 then protocol_type is “tcp”,
when both protocol_type_icmp and protocol_type_tcp has 0 then it implies other protocols.
Similarly,
if service_ecr_i is 1 then service type is “ecr_i”,
if service_private is 1 then service type is “private”,
"Other" services will be captured when both service_ecr_i and service_private has 0.
if flag_S0 is 1 then flag type is “S0”,
if flag_SF is 1 then flag type is “SF”,
"Other" flags will be captured when both flag_S0 and flag_SF has 0.
3) Yes, Field#9 i.e. "logged_in" is also a binary feature where '1' represents user is successfully logged in, '0' otherwise